CVE-2019-3806

CVSS 5.4 MEDIUMEPSS 1.5%CWE-358

An issue has been found in PowerDNS Recursor versions after 4.1.3 before 4.1.9 where Lua hooks are not properly applied to queries received over TCP in some specific combination of settings, possibly bypassing security policies enforced using Lua.

CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:H

Affected products

Power DNS · pdns-recursor

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3806 https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2019-01.html